Alibaba Group will bar employees from using Anthropic’s Claude Code in the workplace starting 10 July, after security researchers discovered that the tool contained hidden code capable of identifying users linked to China. The Chinese e-commerce and cloud company added Claude Code to an internal list of high-risk software with security vulnerabilities, according to an internal notice seen by the South China Morning Post, and is directing staff to use its own Qoder platform instead. The move marks a sharp escalation in the operational friction between US and Chinese artificial-intelligence firms.

Security researchers who reverse-engineered recent versions of Claude Code found that the software inspected proxy configurations and time-zone settings, and inserted imperceptible markers into system prompts that could signal whether a user was in China or affiliated with a Chinese AI laboratory. Much of the logic was obfuscated in the binary, and the release notes made no mention of the mechanism. An Anthropic employee acknowledged on social media that the feature was an experiment launched in March, intended to detect unauthorised account resale and protect against model distillation. The company said it would remove the check in the next release.

The ban follows a separate accusation by Anthropic that Alibaba’s Qwen lab operated nearly 25,000 fraudulent accounts to scrape Claude outputs—a distillation effort that Anthropic described in a letter to US senators. Viewed from Beijing, the hidden-code discovery has reinforced concerns about data security and prompted Alibaba to treat Claude Code as a backdoor risk. Other large Chinese firms, including Ant Financial and ByteDance, have previously used workarounds such as Singapore-based corporate accounts and VPN-reimbursed personal subscriptions to access Claude, practices that contravene Anthropic’s terms of service but do not violate US or Chinese law.

Washington’s own posture has oscillated. In mid-June the US government imposed emergency export controls on Anthropic’s latest Fable 5 and Mythos 5 models after researchers demonstrated a cybersecurity-safeguard bypass; the restrictions were lifted on 30 June after Anthropic built a new classifier that redirects sensitive prompts to an older model. The episode has not halted the broader shift: Chinese models such as Z.ai’s GLM-5.2 are gaining developer traction on platforms like OpenRouter, and some US technology figures note that open-weight Chinese systems are closing the capability gap at a fraction of the cost. The next concrete marker is the 10 July entry-into-force of Alibaba’s ban, alongside Anthropic’s promised removal of the tracking code, which will test whether the two sides can contain the dispute to commercial terms or whether it widens into a broader decoupling of AI toolchains.